CVE-2026-56705: Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to reach an affected Adminer instance and submit a crafted MSSQL server value. No authentication or user interaction is required; the attack injects ODBC parameters into the PDO DSN using semicolons.
Which deployments are most exposed?
Adminer installations that support MSSQL connections and are reachable by unauthenticated users are exposed. The reported technique writes PHP code through injected TraceFile and TraceOn parameters and requires the resulting trace file to be accessed to obtain remote code execution.
How can I determine whether my instance is affected?
Check the Adminer version in use. Versions before 5.4.3 are affected; version 5.4.3 or later is not identified as affected by the provided information.